Hacker News Reader

Comment by bob1029 | Hacker News Reader

I learned about the consequences of overloading the human operator when working on the primary UI for a manufacturing business. A natural inclination is to put things like confirmation dialogs around dangerous activities. I had managers telling me that one confirmation wasn't enough and that we had to add additional because people were still missing.

Eventually, we tried removing the dialogs altogether and the incident rate approached zero. If you take away the guardrails completely, it radically alters the psychology and game theory around user interaction. Imagine climbing a tall building with multiple layers of protection vs having none at all.

I strongly believe in ideas like "safety 3rd". It's not that I want the humans to be maimed by the machines. Quite the opposite. The difficulty is in understanding higher order consequences of "safety" and avoiding the immediate knee-jerk satisfaction that first order resolutions may provide.

View on HN

> Eventually, we tried removing the dialogs altogether and the incident rate approached zero. If you take away the guardrails completely, it radically alters the psychology and game theory around user interaction. Imagine climbing a tall building with multiple layers of protection vs having none at all.

I think there's evidence and studies on this. IIRC removing traffic lights forces people to be much more alert, reducing accidents.

Fun fact: Bhutan is perhaps the only country in the world without traffic lights!

> IIRC removing traffic lights forces people to be much more alert, reducing accidents.

No way this would work long-term in Germany. Maybe there wouldn't be that many more accidents but traffic would stutter, all the time, everywhere. Some safety-first drivers still don't get how roundabouts work ...

Yeah I thought the point is not necessarily safety but to organize things so everyone can move faster. In some of my intersections everything runs fine without traffic light but once it gets crowded, someone comes down and organize things.

> Fun fact: Bhutan is perhaps the only country in the world without traffic lights!

Afaict they have police officers regulating traffic instead. Not much difference in this particular discussion.

Years ago I did a lot of driving around rural Latin America and it could not have been more different from a US city. Official traffic rules were almost non-existent in many areas but the informal ones that had evolved worked shockingly well. Like a cramped two way street might only have room for one car in spots, but there would be a pattern for pulling over and letting opposing traffic pass.

Things like that would probably break down at a certain level of crowded-ness, but it did somewhat change my view of regulation in general. I think there are a lot of cases where people will figure things out just fine if you leave them alone and count on them to be responsible, versus having a million detailed rules that are poorly enforced.

My gripe is with multi-layer approvals for permission request tickets. If it's only 1 layer, the only layer will make sure the person it's correct. However once there are >1 layer, each layer will think the other n-1 layers will check and turn out no one will check and blindly approve things...

In litigious countries confirmations and alerts also serve as a mitigation against lawsuits.

> If you take away the guardrails completely, it radically alters the psychology and game theory around user interaction

Cool! Did workers expect consequences for incidents? Did they get rewarded for lack of incidents?

Meaning, I imagine a world where there are no consequences for incidents and removing guardrails doesn’t lower incident rates because people aren’t incentivized to care?

Or you’re saying they naturally cared and removing guardrails allowed them to take ownership?

It was definitely more of a stick than carrot situation.

The issue with multiple dialogs is that the operator could claim that they were confused with conflicting wording and the implications of things like "Confirm" vs "Cancel" in certain contexts of use. This provides some degree of cover for moving with less care. With no dialog at all, the operator has nothing to point to but their own actions. There is nothing to hide behind.

The fact that this was also a heavily multi-lingual/cultural environment amplified the effect of poorly designed safety mechanisms dramatically.

Confirm/Cancel (like Yes/No) for dialog buttons has been known to be confusing and detrimental for decades now. The button names should always describe action to be taken, not a response to the text above.

My point is that the operator may be genuinely confused by a poor interaction model. Removing that interaction model entirely is certainly an option, but it's not clear that comparing "no dialog" vs "bad dialog" is a strong argument for "dialogs bad, better to have none" - you don't have data for the "good dialog" case, which may be better still.

I remember being confused as a kid by "Yes/No/Cancel" when the computer asked "Do you want to save the changes...?" because I couldn't figure out whether "Cancel" meant "Yes" or "No" and why on earth would one have a third option. I then realized it meant to "cancel" my intention to close the file. I had been confused because I thought it meant to "cancel" the computer's intention to ask me.

Also, I was that obnoxious kid who, after asking someone a yes/no question, used to add "Yes/No/Cancel" (probably to highlight my perceived absurdity of that button).

Like the "Cancel subscription" dialog with options "Cancel" and "Cancel"...

UX Design is hard...

Really interesting, thanks.

Kind of reminds me of parallels to not wearing a seatbelt making someone drive with more care.

Having worked in this space for over a decade (but not in the last 7 years), your comments surprise me. Is this a smaller operation perhaps?

In general, operator UX (HMI, human machine interface), is a an area that’s well researched and more or less standardised in recent times (ISA101). Abnormal Situation Management (ASM), Situational Awareness, automatic alarm suppression for “consequential alarms”, High Performance Graphics (basically everything grey except the stuff that matters). If your Engineers do a good job; the operators can do a good job.

Removing all interlocks sounds like a bit of a cop-out to me. Interlocks are there to prevent the mis-click pouring molten steel on peoples heads. If you have a nice boring standardized ASM HMI, operators can’t “hide behind them”. Every operation is the same.

Documented phenomenon:

> Risk compensation is a theory which suggests that people typically adjust their behavior in response to perceived levels of risk, becoming more careful where they sense greater risk and less careful if they feel more protected.[2]

* https://en.wikipedia.org/wiki/Risk_compensation

I’ve had to add more confirmations as people connect remotely using VNC and accidentally click buttons which then have real world actions.

To catch them all it logs the user out so buttons which affect the process are disabled, but now it can be annoying to be logged out after x minutes and always logging in.

I heard an anecdote years ago about some medical device where people were clicking through confirmations without reading, so they made the user type IRREVERSIBLE on the keyboard to proceed.

Reply on news.ycombinator.com